CVE-2026-31431

🔐 CVE-2026-31431 - Kernel Exploitation Research Framework Modular framework for studying a Linux privilege escalation LPE vulnerability based on AFALG + Page Cache Injection techniques. 🎯 Objective This project is designed for: Research of Linux kernel vulnerabilities Teaching real exploitation...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

block-copyfail

Summary CVE-2026-31431 "Copy Fail" is a Linux kernel privilege escalation vulnerability in the algifaead cryptographic interface. An attacker uses AFALG sockets with the authencesn algorithm and splice to corrupt arbitrary files in the kernel page cache — including setuid binaries like /usr/bin/s...

copy-fail-CVE-2026-31431-shell

CVE-2026-31431 - copyfail shell Local privilege escalation via AFALG socket + splice page-cache overwrite. Overwrites a read-only SUID binary /usr/bin/su with a minimal ELF that calls setuid0 + execve"/bin/sh". No race condition, no per-distro offsets, single shot. root@kitploit: $...

copy-fail-CVE-2026-31431-poc

CVE-2026-31431 — Copy Fail Proof of Concept This repository contains a Proof of Concept exploit for CVE-2026-31431 , a high-severity Linux kernel local privilege escalation vulnerability that allows any unprivileged local user to gain root access. The flaw, dubbed “Copy Fail”, resides in the...

CVE-2026-31431-Exploit

CVE-2026-31431 "Copy Fail" Exploit A professional proof-of-concept for the CVE-2026-31431 vulnerability, a critical flaw in the Linux kernel's algifaead / authencesn page-cache handling. Overview The CVE-2026-31431 vulnerability, colloquially known as "Copy Fail" , involves a page-cache...

RK35xx-CopyFail-Hotfix

RK35xx Kernel Patch: CVE-2026-31431 "Copy Fail" RK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Joshua Riek's Ubuntu 24.04 A community-provided, pre-compiled kernel patch for all RK35xx single-board computers Rock 5, Orange Pi 5, NanoPC, etc. running Joshua Riek's Ubuntu 24.04 Kernel...

Copy-Fail---CVE-2026-31431

CVE-2026-31431 - Copy Fail - Detection Script Python script to check whether a Linux system is vulnerable to the CVE-2026-31431 Copy Fail flaw, a local privilege escalation in the Linux kernel. The flaw in brief Since 2017 commit 72548b093ee3, the kernel's algifaead cryptographic module has handl...

Copy-fail-CVE-2026-31431-Exploit-in-C

Copy-fail-CVE-2026-31431-Exploit-in-C Discovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/. Overview This program targets the Linux kernel’s AFALG AEAD path and attempts to trigger the “Copy Fail” page-cache corruption behavior described in public...

CopyFail-for-dummies

Copy Fail / CVE-2026-31431 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Copy Fail and tracked as CVE-2026-31431. The purpose of this material is: to explain the bug mechanism at a...

copy-fail-CVE-2026-31431

Vulnerability Description Root Cause In 2017, the Linux kernel crypto module authencesn introduced an in-place optimization for AEAD Authenticated Encryption with Associated Data operations. This optimization caused read-only pages in the page cache to be incorrectly placed into a writable...

copyfail-rs

copyfail-rs Copy Fail exploit CVE-2026-31431 but in Rust, a critical vulnerability chaining AFALG and splice to achieve a 4-byte page cache write, leading to local privilege escalation on major Linux distributions. Based on the research and PoC by Xint Code. Disclaimer !CAUTION This project is fo...

CVE-2026-31431

CVE-2026-31431: Copy Fail PoC + ARM64 Validation Copy Fail is a Linux local privilege escalation published by Theori/Xint as CVE-2026-31431. The project page describes a logic bug in authencesn that can be reached through AFALG and splice, producing a small page-cache write against a setuid binar...

CVE-2026-31431

copy.fail — AFALG AEAD splice primitive CVE-2026-31431 Overview This project is a C port of the original Python prototype, by offsecguy. It leverages the Linux kernel crypto API AFALG using: authencesnhmacsha256,cbcaes AEAD mode MSGMORE flag splice system call The technique feeds data from a...

CVE-2026-31431

CVE-2026-31431 — "Copy Fail" Local Privilege Escalation Overview CVE-2026-31431 is a local privilege escalation vulnerability in the Linux kernel's algifaead subsystem. The authencesn AEAD implementation performs an in-place decrypt via splice2, placing a page-cache page into the destination...

copyfail-c

copyfail-c A minimal C reproduction for researching Copy Fail CVE-2026-31431. This repository contains a compact C implementation built around the Linux kernel AFALG interface for vulnerability research, behavior analysis, and controlled reproduction. Repository layout root@kitploit: . ├── src/ C...

CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script

CVE-2026-31431 — Copy Fail — Vulnerability Detection Script Detection only. A working PoC already exists at copy.fail/exploit. This script is for sysadmins and security teams determining where they are vulnerable — or still vulnerable after patching. What's this about? On April 29th 2026, a...

CVE-2026-31431-Linux-Copy-Fail

CVE-2026-31431 - Linux Copy-Fail Exploit Rust A Rust implementation of a local privilege escalation exploit for CVE-2026-31431 Copy-Fail. It allows executing customized shellcode such as Meterpreter Introduction Xint disclosed CVE-2026-31431, an arbitrary page cache write vulnerability that chain...

Copy_Grail

copygrail | copy-fail-CVE-2026-31431 copygrail is a compact, single-file C++ implementation of the CVE-2026-31431 "Copy Fail" local privilege escalation vulnerability. It showcases a clean AFALG + splice page cache corruption technique that can be used to overwrite a setuid binary and escalate...

CVE-2026-31431-Patch

CVE-2026-31431 Copy Fail Mitigation & Patch Script Image Before Patch and Vulnerable Image After Patch With Script This repository contains a specialized bash script designed to mitigate and patch CVE-2026-31431 , also known as "Copy Fail". This vulnerability is a critical Local Privilege...